When you view the full headers of your email The Ip of the sender will be either the first or last Received From line depending on how your email program displays it. This would be the ip address you would use when you do your neotrace or other ip lookup such as AO's ip locater. The other addresses are merely stops along the way. But if need be that your email was a forged email you could use the other ip addresses to contact the admins of the server incase they have an open port that allowed the person to send you the virus.

PeacE
-BoB